class LogStash::Filters::Cusum
This filter will take make a cumulative sum based on given add_values dictionary. The first value will be taken from the initial_values dictionary. The filter then takes the stored value (or initial value if there's no stored value yet) and adds what is in the add_values dictionary. If there is no add_value 0 is added.
If there is no initial_value for a given field 0 will be used
Usage:
filter {
cusum{ fields => ["apples","bananas"] add_values => { "apples" => "%{[apples_to_add]}" "bananas" => "%{[bananas_to_add]}" } initial_values => { "apples" => "0" "bananas" => "%{[default_bananas]}" } }
}
Public Instance Methods
filter(event)
click to toggle source
# File lib/logstash/filters/cusum.rb, line 44 def filter(event) @logger.debug? && @logger.debug("[cusum] Applying cusum filter") @fields.each do |field| # take the value from the map val = @cusum[field] if val.nil? if @initial_values.nil? # if there is no initial_values we set current value to 0 val = 0 else # if there is no value stored yet set it to the starting value. If there is no given starting value, our own default is 0 val = @initial_values[field].nil? ? 0 : event.sprintf(@initial_values[field]).to_i #NO CHECK ON validity :'( end end # val.nil? @logger.debug? && @logger.debug("[cusum] cusum value for #{field} was #{val}") if @add_values.nil? # If there is no add_values we set to_add to 0 (no change) to_add = 0 else # Take the to_add value from values to add. If no value is specified we add 0 (no change) to_add = @add_values[field].nil? ? 0 : event.sprintf(@add_values[field]).to_i #NO CHECK ON validity :'( end @logger.debug? && @logger.debug("[cusum] value to add for #{field} is #{to_add}") # Store in the map the sum @cusum[field] = val + to_add @logger.debug? && @logger.debug("[cusum] cusum value for #{field} isn now #{@cusum[field]}") # Set on the event the field with the cusum value. Overriding any current value event.set(field,@cusum[field]) @logger.debug? && @logger.debug("[cusum] set event field #{field} to #{@cusum[field]}") end # @fields.each do # filter_matched should go in the last line of our successful code filter_matched(event) end
register()
click to toggle source
# File lib/logstash/filters/cusum.rb, line 38 def register @cusum = Hash.new @logger.debug? && @logger.debug("[cusum] Creating locally stored hash") end